Errors with firefox

------=_Part_16954_33087895.1138025984980
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Hello there

Not sure if the underlying problem here is with mod_ssl or openssl or
something else - so apologies if this email is going to the wrong place.

I have apache compiled on solaris with sun cc with mod_ssl-2.8.25-1.3.34 an=
d
openssl-0.9.8a (I've also tried 0.9.7i).

When accessing the site using Internet Explorer I have no problems. With
Firefox the browser reports an 'incorrect Message Authentication Code' and
the server logs report:

[Mon Jan 23 13:13:54 2006] [error] mod_ssl: SSL handshake failed (server
xxx:443, client xxx) (OpenSSL library error follows)
[Mon Jan 23 13:13:54 2006] [error] OpenSSL: error:1408F455:SSL
routines:SSL3_GET_RECORD:decryption failed or bad record mac

I do have previous builds that 'work' ... but have been unable to determine
precisely what change initiated this problem. One possible suspect is the
Sun compiler, which was now from studio 11 and was previously from an
earlier version which I don't have access to any more.

Any suggestions much appreciated

Thanks

Michael Smith

------=_Part_16954_33087895.1138025984980
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Hello there

Not sure if the underlying problem here is with mod_ssl =
or openssl or something else - so apologies if this email is going to the w=
rong place.

I have apache compiled on solaris with sun cc with mod_s=
sl-
2.8.25-1.3.34 and openssl-0.9.8a (I've also tried 0.9.7i).

When acce=
ssing the site using Internet Explorer I have no problems.  With Firef=
ox the browser reports an 'incorrect Message Authentication Code' and the s=
erver logs report:


[Mon Jan 23 13:13:54 2006] [error] mod_ssl: SSL handshake failed (s=
erver xxx:443, client xxx) (OpenSSL library error follows)
[Mon Jan 23 1=
3:13:54 2006] [error] OpenSSL: error:1408F455:SSL routines:SSL3_GET_RECORD:=
decryption failed or bad record mac


I do have previous builds that 'work' ... but have been unable to d=
etermine precisely what change initiated this problem.  One possible s=
uspect is the Sun compiler, which was now from studio 11 and was previously=
from an earlier version which I don't have access to any more.


Any suggestions much appreciated

Thanks

Michael Smith=






------=_Part_16954_33087895.1138025984980--
____________________________________________________________ __________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List modssl-users@modssl.org
Automated List Manager majordomo@modssl.org

RE: Errors with firefox

This is a multi-part message in MIME format.

------_=_NextPart_001_01C62029.E482DE95
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

I had exactly the same problem when I compile my new Apache server
(2.2.0) with mod_ssl. To be short, I think you are using the packaged
OpenSSL. I fixed the problem by re-compiling the OpenSSL on the system
with shared option, but first remove the pre-installed OpenSSL package.

=20

- Ming Yu

- Johns Hopkins University Applied Physics Lab. =20

=20

________________________________

From: owner-modssl-users@modssl.org
[mailto:owner-modssl-users@modssl.org] On Behalf Of Michael Smith
Sent: Monday, January 23, 2006 9:20 AM
To: modssl-users@modssl.org
Subject: Errors with firefox

=20

Hello there

Not sure if the underlying problem here is with mod_ssl or openssl or
something else - so apologies if this email is going to the wrong place.

I have apache compiled on solaris with sun cc with mod_ssl-
2.8.25-1.3.34 and openssl-0.9.8a (I've also tried 0.9.7i).

When accessing the site using Internet Explorer I have no problems.
With Firefox the browser reports an 'incorrect Message Authentication
Code' and the server logs report:=20

[Mon Jan 23 13:13:54 2006] [error] mod_ssl: SSL handshake failed (server
xxx:443, client xxx) (OpenSSL library error follows)
[Mon Jan 23 13:13:54 2006] [error] OpenSSL: error:1408F455:SSL
routines:SSL3_GET_RECORD:decryption failed or bad record mac=20

I do have previous builds that 'work' ... but have been unable to
determine precisely what change initiated this problem. One possible
suspect is the Sun compiler, which was now from studio 11 and was
previously from an earlier version which I don't have access to any
more.=20

Any suggestions much appreciated

Thanks

Michael Smith





------_=_NextPart_001_01C62029.E482DE95
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns=3D"http://www.w3.org/TR/REC-html40">


charset=3Dus-ascii">

RE: Errors with firefox

--==_Exmh_1138031040_565P
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

and with explorer too.

Hello out there,

Ming.Yu=40jhuapl.edu said:
> had exactly the same problem when I compile my new Apache server (2.2.=
0)
> with mod_ssl. =A0To be short, I think you are using the packaged OpenSS=
L. =A0I
> fixed the problem by re-compiling the OpenSSL on the system with shared=

> option, but first remove the pre-installed OpenSSL package.=20
I've got the same problem. I compiled openssl-0.9.8a with Sun Forte Studi=
o 10.
doesn't matter, problem remains.

For the record. Created our own root-CA, signed it by himself,
Created server-certificate and signed it by the just created root-CA.
Loaded the root-CA into firefox/explorer and configured apache with the=20
server-certificate without errors.
firefox and explorer complain with unknown error, when initiated https-re=
quest.

On command-line, I've verified the certificate with
openssl verify -issuer_checks -CApath /var/opt/openssl /etc/opt/apache2/s=
sl.crt/server.crt

which results in
error 29 at 0 depth lookup:subject issuer mismatch

That seems the main problem.
Perhaps the creation of our root-CA/server-cert=20
process isn't correct. Or 0.9.8a isn't as tolerant as 0.9.7.
(we followed the same procedure, as with 0.9.7 a year ago.) So it's an=20
openssl-problem.

The web suggestes, that organisation-name of certificate and root-CA shou=
ld be=20
different in each/all parts of the name. But I'm a little bit unwilling t=
o=20
accept this argument, because it's unresonable to me. One difference shou=
ld be=20
sufficient. That the case in our process.

Thanks for commenting

Klaus

--=20
=22Sure, vi is user friendly.
It's just particular about who it makes friends with.=22 ;-)=20
_________________________
Klaus Elsbernd; System Administrator, BOFH =7C elsbernd=40dfki.uni=
-kl.de
Deutsches Forschungsz. für Künstliche Intelligenz =7C DFKI GmbH, Geb.=
57/285
67657 Kaiserslautern; Germany Fernruf: 0631/205-3486 Fernbild: -3=
457



--==_Exmh_1138031040_565P
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (SunOS)
Comment: Exmh version 2.7.2 01/07/2005

iQCVAwUBQ9T5wGrOJahe3R7NAQLG/AP7B7sPgMsFnWjbhBX7yL6F6adJh00w HaWR
XYvXDLFyOiNserm9erdhIVwRPXfMLOdUyrHJ0DSiRGFQWTHqKqSbXNM9b8bC yDOn
iOwcReQFcjQfFKIIUM2uqLCDWBB+LLceaAGZrgHxAjIQ67m0Lp/AxfxfyPn+ Cnxj
+tefh0CgN0M=
=ysKT
-----END PGP SIGNATURE-----

--==_Exmh_1138031040_565P--
____________________________________________________________ __________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List modssl-users@modssl.org
Automated List Manager majordomo@modssl.org

Re: Errors with firefox

------=_Part_12251_19215323.1138093139206
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Hi there,

We don't appear to have an packaged openssl on this system so I don't think
that is my particular problem. However I'm somewhat reassured in that othe=
r
people are seeing this too so it's hopefully not something too stupid that
I'm doing!

Michael

On 1/23/06, Yu, Ming wrote:
>
> I had exactly the same problem when I compile my new Apache server (2.2.=
0)
> with mod_ssl. To be short, I think you are using the packaged OpenSSL. =
I
> fixed the problem by re-compiling the OpenSSL on the system with shared
> option, but first remove the pre-installed OpenSSL package.
>
>
>
> - Ming Yu
>
> - Johns Hopkins University Applied Physics Lab.
>
>
> ------------------------------
>
> *From:* owner-modssl-users@modssl.org [mailto:
> owner-modssl-users@modssl.org] *On Behalf Of *Michael Smith
> *Sent:* Monday, January 23, 2006 9:20 AM
> *To:* modssl-users@modssl.org
> *Subject:* Errors with firefox
>
>
>
> Hello there
>
> Not sure if the underlying problem here is with mod_ssl or openssl or
> something else - so apologies if this email is going to the wrong place.
>
> I have apache compiled on solaris with sun cc with mod_ssl- 2.8.25-1.3.34=
and
> openssl-0.9.8a (I've also tried 0.9.7i).
>
> When accessing the site using Internet Explorer I have no problems. With
> Firefox the browser reports an 'incorrect Message Authentication Code' an=
d
> the server logs report:
>
> [Mon Jan 23 13:13:54 2006] [error] mod_ssl: SSL handshake failed (server
> xxx:443, client xxx) (OpenSSL library error follows)
> [Mon Jan 23 13:13:54 2006] [error] OpenSSL: error:1408F455:SSL
> routines:SSL3_GET_RECORD:decryption failed or bad record mac
>
> I do have previous builds that 'work' ... but have been unable to
> determine precisely what change initiated this problem. One possible
> suspect is the Sun compiler, which was now from studio 11 and was previou=
sly
> from an earlier version which I don't have access to any more.
>
> Any suggestions much appreciated
>
> Thanks
>
> Michael Smith
>
>
>

------=_Part_12251_19215323.1138093139206
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Hi there,

We don't appear to have an packaged openssl on this system=
so I don't think that is my particular problem.  However I'm somewhat=
reassured in that other people are seeing this too so it's hopefully not s=
omething too stupid that I'm doing!


Michael